101–110 of 152 posts
Earlier quoted context omitted.
I draw that line at around 99.9% availability.
Availability is a measured outcome. How's it gonna help you quantify your various risks _before_ they become a problem so you can spend your mitigation time wisely?
Earlier quoted context omitted.
- 'one more step away from a corporate-controlled internet" Downvote me to grey-world if you like, but I think everyone's crazy to put all their code infrastructure in the hands of fucking Microsoft . Especially literal free open-source software. Who do you think Microsoft is? What do you know of Microsoft's history and their core values (they're "embrace, extinguish & exsanguinate"). It's like giving fucking Sauron…
What exactly is the risk? That they'll stop providing the services they sell today? The design of git makes switching to another primary remote very easy (granted, most users probably don't have good habits around backing up data from Issues/Wiki/Releases and risk losing that data if it's taken away suddenly -- but the repo itself is durable and portable on a whim.
> The design of git makes switching to another primary remote very easy
It is never as easy as just switching to another primary remote.
It's not just Issues/Wikis/Releases, but the build/CI process(es) that are rampant on GitHub now, the community you've built potentially coming up on GitHub and not really getting that there's anything else out there, etc.
This is all time consuming hard work. People will often just not do it, and this is why we have lock in everywhere. Stop calling it easy.
The centralization of the internet around a few specific services - like GitHub, Cloudflare, and so on - is an increasingly problematic thing to contend with.
Edit: "as a easy" -> "as easy"
Earlier quoted context omitted.
I know this a greybeard's fantasy and that most people working today were trained not to bother, but: important things should not have GitHub as a failure point . Hobby projects and today's work? Sure. Point straight at GitHub and hack away. And when it goes down, get yourself a coffee. But everything that's anywhere near production should have already pointed those github requests to a mirror or other tool in your o…
It's not entirely clear to me whether you're talking about using GitHub for your own production tooling, or as a source for some arbitraty third party component. If it's the latter, then I completely agree with you. Use a read-through proxying package repository. I don't care if you run it yourself or if you pay a provider, but don't pull stuff from the origin every time you build. In the general case, adoping an ext…
I've since read many sibling replies fret over build automation or source code storage, but some downtime in build automation will rarely damage customers and (my goodness) I hope people aren't trusting the only copy of all their IP to a business partner and that they always have a very recent backup somewhere they own themselves.
My repos were coming up as 404s. I was wondering if I had been canned...
Guess I can't treat github like a CDN.
Recently github is pushing very agressively for two factor authenticartion.
So I installed the authenticator app.
But the authenticator does not work when the clock on my phone is not perfectly synchronized. But my phone's clock is intentionally sped up by +15 minutes?
What to do?
Earlier quoted context omitted.
I think you don't want to reveal the presence of projects by name or not -- just the name of repo could be sensitive info, potentially.
Except they know you've accessed it previously. Its a different threat model that leaves room for a little more agency to be given to the user.
Or know which user to pull history for
Earlier quoted context omitted.
It shouldn't be on github then. At all.
Why the downvotes? If you want real security, self-host your Git repo.
Earlier quoted context omitted.
It's not that black and white. Where do you draw the line on what can and can't be a failure point? My cloud provider is probably an acceptable point. If every AWS region goes down I'm not going to have a spare cloud provider. What about an auth provider? Do I need a backup there? What about CI, do I need multiple CI systems? 3rd party search services, realtime messaging services, the list goes on. For 1% of systems,…
That's all besides the point isn't it? Everything you mentioned can be replaced. Your source code can't.
But that takes longer than the expected duration of this outage, and is a lot of work. It's not like we have a standby gitea we can just seamlessly switch to, so we are still hit by this outage. On the other hand for build dependencies we do have a standby mirror.
Earlier quoted context omitted.
Sadly, GitHub doesn't store its value-add assets within the repository itself; so all of the PR conversations, Gists, Issues, and so forth aren't within git itself.
That's by-design, and it's why no one should ever use Microsoft GitHub -- because you don't own your data, Microsoft does.
Earlier quoted context omitted.
It's amazing how many of these issues can be obviated by taking a step back at a given SAAS, asking can I self host this, then if you can and need redundancy to just buy two desktops and stick one in your place and another in your friends apartment in another town. With a lightweight static site, a modern desktop is probably more than powerful enough to deal with most any load you might realistically see for your giv…
So how do you keep data synced between them in a manner that ensures the data is safe? Now you're playing security sysadmin, and you're playing backup administrator, and your playing hardware admin (did you use 2 SSDs bought at the same time?). You don't ever escape the payment cost of the issues of keeping these systems running. You're paying staff to do it, you're paying a cloud provider to do this, or you're payin…